Analysis
-
max time kernel
153s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe
-
Size
2.4MB
-
MD5
a33ad34a69704593a9f32632ce27386c
-
SHA1
ba00748c45036d821d3030ec24c88d6a28480aac
-
SHA256
f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4
-
SHA512
9e6b322e4955895fbee2b97ca49da6bdc2c06b41cf9815660fb86385c4bf93c275161ea4a4865ad2790efe9a4a0cfaca16f60ac5b4e8c2cd5a6fa93fa435503e
-
SSDEEP
49152:quqqYqqhRRwZ6MeGnVsyWxwChYAgsMMMMMM9ncdQsLp25wwyje/5IqNTYlMbv/es:+qfq7RwZPdKylAMMMMMM9ncGr/59Ylpm
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List servicew.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\windows\servicew.exe = "c:\\windows\\servicew.exe:*:Enabled:System Update" servicew.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msrpc = "c:\\windows\\msrpc.exe" servicew.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run servicew.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winsys = "c:\\windows\\winsys.exe" servicew.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run servicew.exe -
Executes dropped EXE 2 IoCs
pid Process 1480 servicew.exe 1164 smart_scan.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\winsys\ImagePath = "c:\\windows\\winsys.exe" servicew.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run servicew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winsys = "c:\\windows\\winsys.exe" servicew.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices servicew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\winsys = "c:\\windows\\winsys.exe" servicew.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run servicew.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsassv = "c:\\windows\\lsassv.exe" servicew.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: servicew.exe File opened (read-only) \??\k: servicew.exe File opened (read-only) \??\i: servicew.exe File opened (read-only) \??\g: servicew.exe File opened (read-only) \??\e: servicew.exe File opened (read-only) \??\u: servicew.exe File opened (read-only) \??\s: servicew.exe File opened (read-only) \??\r: servicew.exe File opened (read-only) \??\q: servicew.exe File opened (read-only) \??\h: servicew.exe File opened (read-only) \??\f: servicew.exe File opened (read-only) \??\z: servicew.exe File opened (read-only) \??\x: servicew.exe File opened (read-only) \??\t: servicew.exe File opened (read-only) \??\o: servicew.exe File opened (read-only) \??\j: servicew.exe File opened (read-only) \??\y: servicew.exe File opened (read-only) \??\w: servicew.exe File opened (read-only) \??\v: servicew.exe File opened (read-only) \??\p: servicew.exe File opened (read-only) \??\n: servicew.exe File opened (read-only) \??\m: servicew.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\regedit.exe servicew.exe -
Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification \??\c:\windows\mui\rctfd.sys servicew.exe File created \??\c:\windows\lsassv.exe servicew.exe File opened for modification \??\c:\windows\msrpc.exe servicew.exe File opened for modification \??\c:\windows\calc.exe servicew.exe File created \??\c:\windows\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeGammaLoader.scr servicew.exe File created C:\Windows\unrar.dll f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File created C:\Windows\setupiwz.dll f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File opened for modification \??\c:\windows\winsys.exe servicew.exe File created \??\c:\windows\regedit2.exe servicew.exe File opened for modification \??\c:\windows\pool32.dll servicew.exe File opened for modification \??\c:\windows\ole32w.dll servicew.exe File created \??\c:\windows\Start Menu\Programs\Startup\AdobeGammaLoader.scr servicew.exe File created C:\Windows\viaud.dll f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File opened for modification C:\Windows\setupiwz.dll f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File created \??\c:\windows\winsys.exe servicew.exe File created \??\c:\windows\msrpc.exe servicew.exe File created \??\c:\windows\pool32.dll servicew.exe File created \??\c:\windows\ole32w.dll servicew.exe File created \??\c:\windows\calc.exe servicew.exe File opened for modification \??\c:\windows\regedit2.exe servicew.exe File created C:\Windows\iecomn.dll f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File created C:\Windows\servicew.exe f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File created C:\Windows\smart_scan.exe f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe File opened for modification \??\c:\windows\lsassv.exe servicew.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} servicew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\ThisEXE = "c:\\windows\\servicew.exe" servicew.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\VerProg = "147" servicew.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1480 servicew.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe 1164 smart_scan.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1164 smart_scan.exe 1164 smart_scan.exe 1480 servicew.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1480 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 27 PID 1476 wrote to memory of 1480 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 27 PID 1476 wrote to memory of 1480 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 27 PID 1476 wrote to memory of 1480 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 27 PID 1476 wrote to memory of 1164 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 28 PID 1476 wrote to memory of 1164 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 28 PID 1476 wrote to memory of 1164 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 28 PID 1476 wrote to memory of 1164 1476 f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe"C:\Users\Admin\AppData\Local\Temp\f335a52b0ac796e4d8cfd3dd3271efeb27acf63f3eb89f36b06fd8bfadf554a4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\servicew.exe"C:\Windows\servicew.exe"2⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Executes dropped EXE
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Windows\smart_scan.exe"C:\Windows\smart_scan.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1164
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
453KB
MD52a753dd7983a26af0bda3b3e83478105
SHA11a12ae754485f05ef33bc3fb8a845a1270cf742a
SHA2563f62b24b68ac0494fd28633e25093e8e3260e1c074cb115047391e8dcaff757b
SHA5126ce9f9e0720dfa83d1fd6ad2006e7f9b717ed2eb1169871259f803bd5fea4e652cbad3267b23f8b752963f21da52b62f1e579e00abd598ff9de90dff584453f2
-
Filesize
457KB
MD5b4206c00b0fbb78c29a8d0eecd6648b7
SHA176f5ca420f2b7ab962d07a32356bbcc73c12e74b
SHA256e17b542bb4cd32713c020a3721382b761d01e5424845341d20e28e11c6d72884
SHA5128bcaa99e8685541ae68ebe5b5860ff6d4fce7fff57f0b23a0dd979482e2bd32374a50b63a906aa2ef133af7edb45f21235fd163e7ac733e318f5064024285649
-
Filesize
684KB
MD50f43b9cf9bb42ecab1a8819cf9411a44
SHA1b73a10c4dc23a3a73c049365d43f334b1ae4492a
SHA25626b3b9896475b103c36fc8ee84e572ec5c63ce7afb036f9230c63c465aec8473
SHA5126fd9b88e288bc9440af370f411484b9a109419a525a14a73315140ee3725b7a6f1902de2ec22719d35935ce41c3d6fc210b51370f10facb5dd1626fdd5bb0597
-
Filesize
18KB
MD525bc58395157cd42319fbfff055bfa8a
SHA14abc9028fdf3330ff47c14542d0196cf801a9275
SHA25626f6b0df01e37d72843e3230989bb73795b83625ffae5c0f185dbc2e9f81ec42
SHA512296d88ed959eb2d107abeb9c3637016713ab508dea637b3d1f4a788bdc4707e5ada9ed22ede6a32bcd82a9bc1f828f9e324981b5614d2f8f375f8b4fb5f298a2
-
Filesize
457KB
MD5b4206c00b0fbb78c29a8d0eecd6648b7
SHA176f5ca420f2b7ab962d07a32356bbcc73c12e74b
SHA256e17b542bb4cd32713c020a3721382b761d01e5424845341d20e28e11c6d72884
SHA5128bcaa99e8685541ae68ebe5b5860ff6d4fce7fff57f0b23a0dd979482e2bd32374a50b63a906aa2ef133af7edb45f21235fd163e7ac733e318f5064024285649